How does Datto RMM determine if a reboot is needed?
The following scenarios in Datto RMM determine that a reboot is needed:
- Reboots are required after a Patch Management policy is run.
- The Reboot Required status appears in the web interface.
Patch mechanism
During a Patch Management policy run, if patches that require a reboot are installed, the reboot.flag
file will be created and delete the following registry key if the option to prevent reboot is selected:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
The file reboot.flag
will be generated in the path C:\ProgramData\CentraStage
. This is what tells the Agent that a reboot from patching is needed and will be picked up on audit.
NOTE This registry key is not used to determine if patches that require reboot were installed.
NOTE The mechanism described in this section is used to determine if the reboot reminder toaster pop-up notification will be displayed. The mechanism described in the next section is not tied to the toaster pop-up notification.
Audit mechanism
This file is created during an audit of the device (as will occur following a patching window). The following registry keys will be checked, and if any indicate a reboot is needed, this will be reflected on the platform for the device. In addition to checking the registry keys, Datto RMM also checks if the reboot.flag
file exists.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
HKLM\SOFTWARE\Microsoft\Updates\UpdateExeVolatile
HKLM\SOFTWARE\Wow6432Node\Microsoft\Updates\UpdateExeVolatile
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending
Audit after reboot
If a reboot is found to be needed during audit or during the Patch Management policy, a field will be updated in user.config.
A directory within C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage
will contain the user.config
file.
Datto RMM uses the folder with the name that corresponds with the latest Agent version. Older folders can be ignored.
If this property has the value of True, an audit will occur when the device reboots. Therefore, the expected behavior is that if a device has the reboot flag set, it should quickly be updated on the platform after a reboot, as an audit should occur following the next reboot.
References
- Patch Mechanism: CentraStage.Cag.Core.Agent.PatchManagement.Patcher in Core.dll
- Method: Worker()
- Method: PreventReboot()
- Reboot.flag mechanism: CentraStage.Cag.Core.Util.FileUtil in Core.dll
- Audit Mechanism: WindowsAgent.Audit in WindowsAgent.dll
- Method: IsRebootNeded()
- DoAuditAfterReboot flag check: CentraStage.Cag.Core.Agent.AgentEngine in Core.dll
- Method: EveryMinute()
- DoAuditAfterReboot gets set in the following two places in Core.dll:
- CentraStage.Cag.Core.Agent.Audit.AuditHandler // Method: DoAudit()
- CentraStage.Cag.Core.Agent.PatchManagement.Patcher // Method: Worker()